The vulnerability is an SQL injection flaw located in the addcomment.php file of the Simple IT Discussion Forum, where manipulation of the postid argument allows attackers to inject arbitrary SQL. This flaw can be exploited remotely to gain unauthorized access to the underlying database, potentially exposing or modifying sensitive information. The attacker can execute any SQL statement that the forum application’s database user is permitted to run. The issue has been publicly disclosed and exploits are available in the wild.

This flaw affects the Simple IT Discussion Forum version 1.0 published by the code-projects organization. No other product versions or vendors are listed as impacted.

The CVSS score of 6.9 indicates a medium severity vulnerability, and the absence of an EPSS score or KEV listing suggests moderate exploitation pressure. However, the public availability of an exploit and the ability to reach the vulnerable endpoint directly from the Internet make this a realistic threat. An attacker would target the /functions/addcomment.php endpoint with a crafted postid value to manipulate the SQL query executed by the application.